Posted
by
BeauHDon Wednesday March 30, 2016 @06:49PM
from the new-ethical-dilemma dept.

After reports that the FBI managed to unlock an iPhone 5c belonging to one of the San Bernardino shooters without the help of Apple, Apple is now the one that needs the FBI's assistance. "The responsible thing for the government to do is privately disclose the vulnerability to Apple so they can continue hardening security on their devices," said Justin Olsson, product counsel at security software maker AVG Technologies. However, many experts in the field believe that the government isn't legally obligated to provide the information to Apple. As mentioned in Los Angeles Times, this creates a new ethical dilemma: Should tech companies be made aware of flaws in their products, or should law enforcement be able to deploy those bugs as crime-fighting tools?

Apple has said from the start that the security on the phone in question was hackable, and that further generations include things like secure enclave that make the only possible means for hacking this particular phone obsolete.

That's why the case was bullshit from the beginning. The FBI could give a fuck about this particular phone, they wanted a precedent on record that Apple had to write custom big brother software (and digitally sign it so it could be installed without wiping the phone, potentially even

Yeah, Apple is approaching the wrong party. That company in Israel found the flaw, and the FBI paid them to use it. Apple has so far been unwilling to encourage folks to expose bugs, by paying them, so....
Logically, especially since it is well known that Apple has plenty of cash on-hand to buy things, Apple should buy the vulnerabililty, instead of expecting to get it for free from the Feds. How greedy do you think ordinary folks are willing to let Apple be, in such circumstances?

Logically, especially since it is well known that Apple has plenty of cash on-hand to buy things, Apple should buy the vulnerabililty, instead of expecting to get it for free from the Feds. How greedy do you think ordinary folks are willing to let Apple be, in such circumstances?

Well, you know how much iOS vulnerabilities go for? Bug bounties that are offered by Google, Microsoft and everyone else pale. $10K? peanuts. An iOS vulnerability sells for $1M. Yes, a million dollars. Hell, Android vulnerabilities

Both the EU and US have first-to-file patent systems now. They don't have to create it first - they only have to patent it first.

This is actually an interesting legal strategy. If someone were to patent a general method for, say, sql injection or a buffer overflow, they could theoretically sue anyone who used it. I wonder how that might play out.

is it really that far fetched for the israeli company to have a bootloader hack or code injection-after-boot-but-before-unlock hack?

because that's all that was needed for hacking the pin protection system on iphone 5C. if you have that, then you can prevent the system from wiping the encryption key after 10 attempts and can attempt the right pin code infinitely.

and apple 99.99999% probably already knows how they did it, so whats there to tell.

There is a very easy, very reasonable trick that is guaranteed to work to get the data out of that phone with minimal risk (assuming it has a 4-digit PIN). It's not a mistake, it's not a bug, it's not something anyone has to "discover". It's simply an attack outside the threat model that Apple used when designing that particular iPhone (and, with minor differences, all currently released iPhones). I have no doubt Apple knows full well it will work and knew it would work when they designed the phone (it's blatantly obvious, and Apple's security engineers aren't idiots) - protecting against it is just not trivial (it cannot be solved by software, it requires support hardware) so, to this date, they've chosen not to. In fact, they added a minor roadblock against it on newer phones (but only a minor one that can also be bypassed - because doing better is Hard(TM) and costs money), which demonstrates they are fully aware of it. I explained how it works here [marcan.st] (search for "replay attack"). I'm not the first one to mention this approach.

Making iPhone secure against all physical attacks is impossible. If your PIN is bruteforceable (as is the case here), then security relies on the PIN attempt counter. An attacker with physical possession of the phone can always find a way in. Apple just has to decide how much effort (and money) they want to put into making that harder. The current bar is at approximately the "a couple experienced hardware/software hackers and a couple thousand dollars in R&D costs" level. With some more money/effort they could raise it to the "a crazy dude like Chris Tarnovsky and a medium-budget silicon hacking lab" level. It's not going to get to the "noone will practically be able to do it" level without making the iPhone into a tamper-resistant hardware security module with physical defenses (i.e. not something likely to fit in your pocket).

It still baffles me why everyone is so concerned about how the FBI got in, when we know an easy way in already.

RAM-resident firmware is still firmware. Ever used a Linux machine? Ever looked in/lib/firmware? All of those are firmware files to be loaded into RAM on various devices that require RAM-resident firmware to run.

Originally I actually used the words software and firmware interchangeably in the article, because the distinction is pretty much moot with devices like the iPhone which blur the line between embedded devices and general purpose computers, but I changed them all to "firmware" for consistency, to av

I've got my tinfoil hat on tight, so it's baseless speculation time:
How do we know Apple didn't help them? They could have just done the court dance to keep up appearances, and help the Feds out on the sly. Win-win: Apple keeps their users happy and even gains extra points for standing up to the government, and they keep up good relations with the Feds.

Example, a police officer knocks on your door. You invite him inside. The officer sees your heroin needle. The officer can arrest you, because you gave him permission to search your home.

Or

A police officer knocks on your door. You kerp him outside, you tell the officer to come back with a warrant. The officer suspects from the conversation you have drugs, he gets a court order to search your home.

Example, a police officer knocks on your door. You invite him inside. The officer sees your heroin needle. The officer can arrest you, because you gave him permission to search your home.

OK, so is it possible now that Apple will file a lawsuit against San Bernadino county for soliciting and giving the FBI permission to conduct activities such as reverse-engineering or disassembly which are prohibited by the software EULA?

What happens if you're at a neighbor's house, and you let the officer in (with

Sure, if said government officials will hand over the phone to be disassembled. Recall that this particular hack is likely NAND mirroring. That requires removing the CPU. Not something you would tend to do in bulk.

Re "should keep quiet."
The US gov had that hidden win with PRISM and ICREACH https://en.wikipedia.org/wiki/... [wikipedia.org]
The cost of parallel construction was not great but the risk of a court of expert teams finally asking questions about the origins of a case was not always risk free.
Hidden cell phone tracking, voice prints and decryption get decades of easy access to start to build a public case.
The press, lawyers, tech experts in the US could slowly see that not all cases got built on informants, ex convicts,

I don't think it matters. Apple must know that the phone can be broken into - and now have a large hint it is possible.

But I don't believe it is the gov't who needs to tell Apple this - Apple could hire the same company and ask them how they did it.

From an ethical hacking point of view - maybe the gov't does have a responsibility to report a vulnerability to the vendor if the attack is "simple" and poses a clear danger to the security of Americans. I believe it is a balancing act with two possibilities.

If you become aware of a means of breaching the security of this device that you own, you are required to reveal it to Apple. Get all other mobile firm companies to add the term to the contract. Then they either have to stop operating mobiles, or hand it over.

Shouldn't Apple be chasing after them for circumventing the encryption and digital rights management system on the phone? Its what they do to people coming up with jailbreaks... why would this be diffrent?

Well, first it was Eric Holder. But now Loretta Lynch says so... Awfully hard to prosecute when the Justice Department acts like the political enforcement arm of the Administration rather than, well, an actual Department of Justice.

Shouldn't Apple be chasing after them for circumventing the encryption and digital rights management system on the phone? Its what they do to people coming up with jailbreaks... why would this be diffrent?

I was thinking about that federal law about "Unauthorized Access to a computer" and/or the "circumventing security measures" law. Both the FBI and/or the supposed "hackers" are guilty of these felonies, period.

And before you say "Court Order", I believe it was just a PROPOSED Order; I don't think it ever became a real Order. And besides, even a Court can't enter an Order to Break the Law...

I was thinking about that federal law about "Unauthorized Access to a computer" and/or the "circumventing security measures" law. Both the FBI and/or the supposed "hackers" are guilty of these felonies, period.

Be specific.

Laws often have exceptions for law enforcement, and even when they don't, prosecutors have a massive amount of discretion in who they prosecute.

It turns out the FBI is allowed to do a lot of things we would not want private citizens to do. Like running their own heavily armed hostage rescue team.

Realistically, this is a balancing question--needs of the state vs. privacy, for a relatively old phone that will be out of circulation in a few years anyway. So it's not terribly important whether the

It turns out the FBI is allowed to do a lot of things we would not want private citizens to do. Like running their own heavily armed hostage rescue team.

I think you could make a case for a private armed hostage rescue team, and I would guess that such an entity has existed for a long time, whether it was the Pinkertons or something like Blackwater.

Arguably it would be preferable to have the police handle a kidnapping rescue, but you can probably invent circumstances where involving the police didn't work somehow -- expediency, corruption of local law enforcement, some kind of overseas situation.

Because the DMCA explicitly "does not prohibit any lawfully authorized investigative, protective, information security, or intelligence activity of an officer, agent, or employee of the United States, a State, or a political subdivision of a State, or a person acting pursuant to a contract with the United States, a State, or a political subdivision of a State."

I doubt they could succeed in this manner. Regardless of what the DMCA says, there's the principle of rex non potest paccare, translated roughly to the King can do no wrong. It's not codified in US law anywhere, but this is the legal doctrine of sovereign immunity. I don't see any exception to sovereign immunity that would allow Apple to succeed in bringing such a suit against the US government. The only way this would work is for Congress to specifically allow such a lawsuit, which seems highly unlikely.

Fine. But what about the NON governmental agency that allegedly did the hacking? I'm not at all sure they inherit that bogus Sovereign Immunity, especially since there was never actually a Court Order, only a Proposed Order.

If the FBI does not reveal the hack so they can hack other phones, well that means the bad guys can also continue using that hack. After all we know that there are now at least 3 organizations who can access a locked iPhone 5c without the owner's password.

We know nothing of the sort. We can assume Apple can do so, but with no further evidence besides an official statement from the FBI, there is no reason to believe that any other organization has such capability.

Hah yep. This case in particular irks me because if I were to take an agent's phone and use an exploit to get into their personal info (not even official bidness data, I'm talking just pulling out a photo of his cat or something) I'd end up in a PMITA prison.

HeHe. What the fuck is indgnance? At least learn how to troll proper. Since I am the boss, yes, it does make me happy. I like to keep on my toes, flow like the wind. I already know what is going on and have done something about it. You will notice that was put in a 3rd person perspective. Maybe if you go back to school, you too will understand sentence structure and overall meaning. Sometimes humor is woven in also to weed out the trolls like your self. You validated my point perfectly. Thank you.

Well, actually, we don't need to leave it to a bunch of internet commenters to decide this issue -- there is an actual process described as "equities review" which the Executive Branch is responsible for, when a cyber vulnerability is known, but not yet disclosed to the public:

The considerations described here (in whether to reveal or keep secret a vulnerability) cover:

-- How much is the vulnerable system used in the core internet infrastructure, in other critical infrastructure systems, in the U.S. economy, and/or in national security systems?--
Does the vulnerability, if left unpatched, impose significant risk?--
How much harm could an adversary nation or criminal group do with knowledge of this vulnerability?--
How likely is it that we would know if someone else was exploiting it?--
How badly do we need the intelligence we think we can get from exploiting the vulnerability?--
Are there other ways we can get it?--
Could we utilize the vulnerability for a short period of time before we disclose it?--
How likely is it that someone else will discover the vulnerability?--
Can the vulnerability be patched or otherwise mitigated?

In this case, I might argue that this is becoming so well known (though the technical specifics have not been revealed), that the FBI/US had better tell Apple to make sure that other users of the affected phones can be secured -- while the intelligence value of the exploit is rapidly decreasing due to its publicity.

there is an actual process described as "equities review" which the Executive Branch is responsible for

Since the FBI is a part of the Executive Branch that is pretty much textbook conflict of interest in this instance. The FBI obviously prefers to keep the ability to circumvent encryption without respect to whether this is either a good idea.

Well, actually, we don't need to leave it to a bunch of internet commenters to decide this issue -- there is an actual process described as "equities review" which the Executive Branch is responsible for, when a cyber vulnerability is known, but not yet disclosed to the public:

The considerations described here (in whether to reveal or keep secret a vulnerability) cover:

-- How much is the vulnerable system used in the core internet infrastructure, in other critical infrastructure systems, in the U.S. economy, and/or in national security systems?--Does the vulnerability, if left unpatched, impose significant risk?--How much harm could an adversary nation or criminal group do with knowledge of this vulnerability?--How likely is it that we would know if someone else was exploiting it?--How badly do we need the intelligence we think we can get from exploiting the vulnerability?--Are there other ways we can get it?--Could we utilize the vulnerability for a short period of time before we disclose it?--How likely is it that someone else will discover the vulnerability?--Can the vulnerability be patched or otherwise mitigated?

In this case, I might argue that this is becoming so well known (though the technical specifics have not been revealed), that the FBI/US had better tell Apple to make sure that other users of the affected phones can be secured -- while the intelligence value of the exploit is rapidly decreasing due to its publicity.

In bureaucratic speak all that means that as long as you can write a well worded memo of justification then you can do whatever you want.

And Apple also knows the Secure Enclave can be by-passed too, by anybody who has the firmware signing key. If you have it, you just upload new firmware bypassing the checks. Currently only Apple has it of course. But that is where this all started.

Still, they should make the FBI rue the day they tried to destroy Apple's market,

Which is real simple to do. Put the Secure Enclave firmware in ROM, so it can't be upgraded. Then it becomes truly uncrackable from software, so the LEA's would be reduced to attacking the silicon. It's their worst nightmare.

And Apple also knows the Secure Enclave can be by-passed too, by anybody who has the firmware signing key.

It is also vulnerable to exactly the same external memory replay attack that non-Secure-Enclave-equipped phones are vulnerable to (i.e. the Secure Enclave is completely irrelevant to what is currently the easiest, most likely way the FBI got into the phone). I explained how all the pieces fit together in this [marcan.st] blog post.

Which is real simple to do. Put the Secure Enclave firmware in ROM, so it can't be u

That's not the solution - Apple needs to be able to update the Secure Enclave firmware too, it's too complex to be reasonable to bake into a ROM forever.

TPM's are more complex, simply because the solve a more general version of the same problem. Billions have been sold, and most of them have got along just fine without a firmware upgrade. We do know how to get bugs below 1 per 100k LOC, and I have no doubt Apple is capable of it. It's not cheap, but I doubt the expense concerns them overly.

You can't update the security enclave as it is flashed once and then it burns a circuit that makes it impossible to update again.

Source? It would be nice if it was true, but if it's true I'd expect to hear Apple trumpeting it from the roof tops. As far a I know, Apple have never said anything publicly. The reference document they publish on security [apple.com] says nothing about firmware upgrades for the Secure Enclave.

The Secure Enclave doesn't have "firmware updates" because it doesn't have nonvolatile firmware memory. Its firmware is loaded on every boot, and is part of the overall firmware of the phone. The Secure Enclave has no control over what firmware runs on it other than ensuring that it is signed by Apple, and it has no persistence of its own - it's a completely state-less CPU that depends on external EEPROM and

The choice is between helping Apple secure the phones of millions of Americans against phone-thieves, identity-thieves, virus, mal-ware and ransom-ware writers or continuing to leave their citizens vulnerable to the above so that the government can spy on it's own people.

Does the FBI care more about fighting crime or reducing crime? There is a common tendency to for people and organizations to try to increase their own importance. So maybe the FBI could help to prevent X amount of crime (in the form of hacking, fraud, etc) from ever happening by helping Apple fix some security flaws. But maybe they will get more credit for allowing this vulnerability to remain and exploiting the vulnerability to catch a few more criminals. It's harder to appreciate crime prevention than punishment of criminals after the fact.

If someone invented a magic security system for houses that eliminated home invasions, this might actually be bad for the prestige of law enforcement. While it will probably reduce crime (one of the purposes of law enforcement), it reduces the reliance of the population on law enforcement and therefore decreases their importance. A flaw in the security system would create the opportunity for more people to be criminals and more opportunity for law enforcement to come to the rescue. If law enforcement can in addition actually exploit this weakness to catch a few more criminals then even better.

If the damage done by leaving the hole open exceeds the damage prevented by leaving the hole open, then it is better for society to have the hole closed, but it is not necessarily better for the FBI to have the hole closed. They won't get the blame for damage caused by an security hole unknown to the public, and they won't get any credit for the damage prevented by closing it.

It would be nice if everyone (especially public officials) did what was best for society rather than what was best for themselves, but this is a rather hard standard to hold human beings to.

I suspect it would be better for society to have the hole closed, but I wouldn't expect the FBI to have the kind of deep dedication to the improvement of society necessary to see that. Maybe it will be easier for them to see if they somehow become the victim (e.g. a scandal resulting from the FBI director's iphone getting hacked, etc).

Take for example Nancy Pelosi. She was all for government surveillance. It was only until she became one of the targets of government surveillance, that she was able to be outraged.

But the head of the FBI overall approved these actions against Apple publicly. Sure some parts of the FBI are full of very fine people, I have a friend in the FBI. But there is rot setting in at the higher levels of FBI management. They think that there is no step too far in their quest to find the bad guys, even if those steps are on top of people. Conviction counts are the goal, they make the budgets bigger and get people promotions and bonuses, and it's a flaw in most law enforcement bodies.

If you keep data on a phone that can be unlocked with a key that the phone is able to check then that data is not secure, it is just very hard to get at. Why? Because the laws of physics do not allow the integrated circuits to be magical black boxes that cannot be monitored, copied and emulated. It is that simple. If you need a 100% secure phone it has to keep all of it's data in the cloud and even then only certain uncommon types of encryption are guaranteed to never be circumvented. This is important as t

You got the "magical black box" part right, but you got the rest wrong.

All you have to do is use a passphrase (not a PIN) long enough to not be bruteforceable. Building a 100% secure device that limits the number of attempts at guessing an insecure PIN is impossible. Building a 100% secure device that protects your data using a secure passphrase is trivial: just use good encryption at rest.

Putting data in the cloud, at best, does nothing for you security-wise, and at worst, makes it that much easier to get

I'm sure all they're doing is taking the plastic off of the NV memory part, attaching a probe, and reading out what's there. Those dies are tested that way at the factory: there will be lands on there for a probe. The government can buy a few phones of the same model for experimentation to get it right, then read out the contents of the NV memory of the phone they care about.

Once they have those contents, it's just a matter of brute-force decrypting whatever is in the personal/confidential files. Remember i

The NV memory part is also encrypted with a key derived from a unique key fused into the CPU SoC (that is too long to be bruteforceable). To do the attack as you describe, they'd have to take the plastic off of the SoC (not the NV part, you can just pull that off the board and read it), and then use a FIB workstation to modify the metal routing and read off the fused UID key to be able to decrypt the external memory and attempt a PIN bruteforce. I explained this and other attacks here [marcan.st]. That attack is techni

Those unique keys are probably recorded at the time of manufacture and saved to a DB (against the serial number of the phone or board). Apple complained about modifying their firmware to put in a backdoor bypassing the PIN entry procedure. I don't think they complained about handing over that CPU key when subpoenaed, or perhaps merely upon a request by the FBI. If the attacker knows the encryption function used by the NV memory controller, then they should be able to emulate that too.

Your article is well-thought out. I would wonder, though, if the UID could be read with a simple optical microscope. Presumably the UID is written to a memory cell on the SoC using links that open (like a fuse) when a high current is passed through (like the old PROM memories used to). Those links wouldn't be embedded in layers of silicon: the opening of the link would heat up and perhaps emit material that would need to be dissipated. (The link would look like this ===-=== or this === === if open.) If such

Presumably the UID is written to a memory cell on the SoC using links that open (like a fuse) when a high current is passed through (like the old PROM memories used to).

Ah, this is where it gets fun. There are actually quite a few OTP storage technologies. Fuses, like what you mention, are one. They're not necessarily on top (indeed, they'd usually be on lower, finer pitch layers, since the whole point of a fuse is that it has to be thin), though, so to read them you'd still need to strip off metallization

You'd have a point, if it were possible to use all combinations of a 256-bit key. It's not, however, Chances are the key is an alphanumeric sequence, less than 8 characters long (most users don't have the patience to do more than that, and most websites don't require more.) That gets you down to the neighborhood of 50^8=3.9 x 10^13, which is far less than 2^256. But they probably don't even need to do that: the password is likely a short phrase out of the Quorran or a close variation on the name of a friend

The *reality* of who the FBI actually are - the people in your community - who you don't know about - who work there - is that they are basically a secret mafia, usually very connected to your local law enforcement and oligarchy that runs your city - and they have super powers that you cannot even imagine to be able to raid and invade anyone's life at will. They are a separate class and truly a branch of the oligarchy, and in ways far more frightening than the mafia/thug class associated historically with

From an external view point the Federal Bureau of Investigation is the only real US police force. County mounties, the law en-FORCE-rs are all too often out of control, trigger happy, lard arse morons. Seriously, all local law enforcement should be disbanded in favour of state based policing overseen by Federal investigators to ensure more uniform policing across a state and equal access to investigatory powers and police oversight across the state. Sure the FBI fucks up on occasion and most of that is caus

In all of your exemple, it's mostly about adult willingly deciding to take those risk. Nobody is stopping you from not smoking, drinking alcohol, driving safely to extent your life expectancy. The way you say it, why should we have a speed limit at all? Your exemples are basically a critic of all safety laws.

In this exemple, we're talking about potentially stopping terrorist attack (And I'm talking in general, from what I heard from this specific case, the iPh

In all of your exemple, it's mostly about adult willingly deciding to take those risk.

No different here. I'm well aware I could be killed by a drunk driver tomorrow (FAR more likely than a terrorist incidentally) and yet I think it would be inappropriate of us to ban alchohol. In fact we tried that and it didn't go well...

In this exemple, we're talking about potentially stopping terrorist attack

I'm an adult willing to take the risk of a terrorist attack in order to protect my civil rights. I value my civil rights more than I fear any terrorist or terrorist group. If that makes the FBI have to work harder to convict a criminal then so be it.

In all of your exemple, it's mostly about adult willingly deciding to take those risk.

No different here. I'm well aware I could be killed by a drunk driver tomorrow (FAR more likely than a terrorist incidentally) and yet I think it would be inappropriate of us to ban alchohol. In fact we tried that and it didn't go well...

In this exemple, we're talking about potentially stopping terrorist attack

I'm an adult willing to take the risk of a terrorist attack in order to protect my civil rights. I value my civil rights more than I fear any terrorist or terrorist group. If that makes the FBI have to work harder to convict a criminal then so be it.

I'm still not convinced. Drunk driving is illegal after all.

And I agree about protecting your civil rights (After all, it took wars to have them), but saving the civil rights of an actual terrorist....

Unless of course you're insinuating that allowing the FBI to force Apple for a terrorism will mean that tomorrow they'll hack every single cellphone in the USA. But if it take a warren for the FBI to crack a phone each time, I think the justice system could handle it (I think I'll regret writing this...).

So is terrorism. What's your point? Something being illegal doesn't keep it from happening.

And I agree about protecting your civil rights (After all, it took wars to have them), but saving the civil rights of an actual terrorist....

That's what having rule of law [wikipedia.org] means. It means EVERYBODY gets treated fairly under the law, including terrorists. The Constitution enumerates several rights [wikipedia.org] which are there to protect from the government abusing its power. Frankly for most of us the government is FAR more likely to be a threat to our life and liberty than any terrorist could ever hope to be. Ask any black citizen and they'll tell you that they a

First, in answer to the actual question, I don't think the FBI should be required to tell Apple how they're doing it--mostly because they're not doing it. Some other company is doing it. So, as another poster put it, if the FBI can be forced, the answer is, "We hired XYZ company to do it. Talk to them and leave us out of it."

I value human lives a lot and each preventable death is a death too many.

Which is not a bad way to feel. The problem is with that word: "preventable."

"Preventable" is usually assessed in hindsight. "Oh, if only we'd known, we could have prevented this."

Imagine that the police suspect I am the culprit in a string of bank robberies. If that is true, then my phone/computer/tablet may have information that would lead to my arrest and conviction. Of course, my phone/computer/tablet may not have that information and I may still be guilty. Or it may not have that information and I may be still be innocent. Is giving up your privacy worth catching a possible bank robber?

Here's where I find there's a major difference.

AFAIK, "One of the most sacred principles in the American criminal justice system, holding that a defendant is innocent until proven guilty!"

So, until proven guilty, I don't think we should hack into your phone. But, if you are proven guilty, I think the police should have the right to build a case to get a warren from a judge to hack into your phone if there's solid evidence that the said phone could hold informat

Meanwhile, the cynical half of my brain is waiting for the FBI to tell us how many thousands of lives this saved.

Well, that's the heart of the question isn't?

Here on/. we seem to focus a lot on the negative from the FBI, the NSA and the likes (unsurprising considering the only tech news about them are, most of the time, about privacy void on their part). But I actually wonder how much good they do. How many lives they directly and indirectly saved. And I guess keeping their accomplishment secret is part of their work.

It's in my nature, but I want to think those people too take their job to heart.

FBI is not legally obliged to share the details, but ethically and morally they should. If the FBI actually cared about the citizens and residents of its country then it would naturally want to cooperate in order to provide a more secure phone that could not be easily hacked by enemies of its country. If the FBI actually cared about the rule of law and the rights and limits granted to the people and government, then it would voluntarily limit itself instead of continually overreaching its power.

Because if someone says "X, then Y, then Z will not unlock an iPhone 5c" then it casts doubt on the whole case.

Law enforcement must learn to be like Caesar's wife and be above suspicion and avoid anything with even an appearance of impropriety. Except that law enforcement has a long history of bending, breaking, and ignoring the rules. When people say "trust me!" at the same time their hands are down our underwear looking for evidence then that's a good sign that they can't be trusted. It's so incredibly

The FBI is the government. Technically the people are the FBI's boss and not vice versa.

Apple owed the FBI nothing, it was not obligated by any law to support the FBI and there was no final appeal to create an obligation. On the other hand, the government of which the FBI is a part have an obligation to defend and support Apple and uphold its rights. Apple was never charged with any crime or even any rumors of criminal activity and yet the government treated it with disdain and hostility.